{"id":"CVE-2026-43250","state":"PUBLISHED","title":"usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted).","publishedAt":"2026-05-06T11:28:41.158Z","updatedAt":"2026-10-30T12:25:18.775Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"1497998749600411d75e60a44f7e572b2348bd9a","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"aad97c92119cb85db105ddda4a44c86cc0748e8c","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"1b72b834511d17f4d069d512f78671f3f210a2f1","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"e74c436f8568af1c60942469d0a2300b3ada3857","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"cea2a1257a3b5ea3e769a445b34af13e6aa5a123","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/chipidea/udc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.29","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.16","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.6","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/chipidea/udc.c"]}],"references":["https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a","https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c","https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1","https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec","https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857","https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"],"weaknesses":[],"ingestedAt":"2026-10-30T12:42:04.495Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43250.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43250","state":"PUBLISHED","datePublished":"2026-05-06T11:28:41.158Z","dateUpdated":"2026-10-30T12:25:18.775Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.996Z"},"containers":{"cna":{"title":"usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke()\n\nThe ChipIdea UDC driver can encounter \"not page aligned sg buffer\"\nerrors when a USB device is reconnected after being disconnected\nduring an active transfer. This occurs because _ep_nuke() returns\nrequests to the gadget layer without properly unmapping DMA buffers\nor cleaning up scatter-gather bounce buffers.\n\nRoot cause:\nWhen a disconnect happens during a multi-segment DMA transfer, the\nrequest's num_mapped_sgs field and sgt.sgl pointer remain set with\nstale values. The request is returned to the gadget driver with status\n-ESHUTDOWN but still has active DMA state. If the gadget driver reuses\nthis request on reconnect without reinitializing it, the stale DMA\nstate causes _hardware_enqueue() to skip DMA mapping (seeing non-zero\nnum_mapped_sgs) and attempt to use freed/invalid DMA addresses,\nleading to alignment errors and potential memory corruption.\n\nThe normal completion path via _hardware_dequeue() properly calls\nusb_gadget_unmap_request_by_dev() and sglist_do_debounce() before\nreturning the request. The _ep_nuke() path must do the same cleanup\nto ensure requests are returned in a clean, reusable state.\n\nFix:\nAdd DMA unmapping and bounce buffer cleanup to _ep_nuke() to mirror\nthe cleanup sequence in _hardware_dequeue():\n- Call usb_gadget_unmap_request_by_dev() if num_mapped_sgs is set\n- Call sglist_do_debounce() with copy=false if bounce buffer exists\n\nThis ensures that when requests are returned due to endpoint shutdown,\nthey don't retain stale DMA mappings. The 'false' parameter to\nsglist_do_debounce() prevents copying data back (appropriate for\nshutdown path where transfer was aborted)."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"1497998749600411d75e60a44f7e572b2348bd9a","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"aad97c92119cb85db105ddda4a44c86cc0748e8c","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"1b72b834511d17f4d069d512f78671f3f210a2f1","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"e74c436f8568af1c60942469d0a2300b3ada3857","versionType":"git"},{"version":"aa69a8093ff985873cb44fe1157bd6db29a20fe4","status":"affected","lessThan":"cea2a1257a3b5ea3e769a445b34af13e6aa5a123","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/chipidea/udc.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.29","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.29","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.75","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.16","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.6","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/usb/chipidea/udc.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1497998749600411d75e60a44f7e572b2348bd9a"},{"url":"https://git.kernel.org/stable/c/aad97c92119cb85db105ddda4a44c86cc0748e8c"},{"url":"https://git.kernel.org/stable/c/1b72b834511d17f4d069d512f78671f3f210a2f1"},{"url":"https://git.kernel.org/stable/c/f4fbf2d4750d12ac8525d2efac1016fa0d84d4ec"},{"url":"https://git.kernel.org/stable/c/e74c436f8568af1c60942469d0a2300b3ada3857"},{"url":"https://git.kernel.org/stable/c/cea2a1257a3b5ea3e769a445b34af13e6aa5a123"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:25:18.775Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"6.12.75"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"6.18.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"6.19.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.29","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}